# 1.6 — WebSocket upgrade (GREEN)

Phase: 1 — Proxy core
Stage: GREEN
Depends on: [1.5](1.5-header-hygiene.md)

- [ ] A route may be configured to allow protocol upgrade
- [ ] An upgrade request on such a route reaches the upstream with its `Upgrade` and `Connection` headers intact, despite hop-by-hop stripping
- [ ] The upstream's `101 Switching Protocols` response reaches the client, and bytes then flow bidirectionally
- [ ] Frames pass in both directions with no buffering delay
- [ ] Client close propagates to the upstream and upstream close propagates to the client
- [ ] An upgrade attempt on a route that does not allow it is rejected, not silently downgraded to a plain proxied request
- [ ] Idle upgraded connections are not cut by the route's read timeout while frames are still flowing

`agent-pod/console` serves a WebSocket and is one of the seven Kong-class Ingresses
being migrated. It is currently publicly routed and unauthenticated into a
shell-capable container, so it must work through the gateway before it can be put
behind gateway auth. Header hygiene and upgrade support interact directly: `Upgrade`
and `Connection` are hop-by-hop, and a naive strip breaks the handshake.

## Verify

```bash
go test ./internal/proxy/... -run TestWebSocketUpgrade -v
# expected: passes — client receives 101 from the stub, an echoed frame round-trips in
# both directions, and closing the client causes the stub to observe a close
```